Create your account
Connect your hospital record to My Health.
Privacy notice
Please read this before you give us any details. It explains who handles your information in My Health, why, and what you can do about it. Creating an account is your choice: your care at the hospital does not depend on it, and you can still get your records from the hospital in person.
Notice version 2026-10-24-draft
Who is responsible for your information
Each hospital whose record you connect is the data controller for your health information and decides how it is used. TibaIQ runs My Health for those hospitals as their data processor, under a written contract, and may use your information only on their instructions. Your account details (mobile number or email, sign-in devices) are held by TibaIQ for the hospitals you connect. Ask the hospital's front desk or its data protection officer if you have a question.
What we use your information for
To create and protect your account; to check that a hospital record is yours before connecting it (we compare your hospital number or national ID, date of birth and the phone on the record, and send a one-time code to that phone); to show you the parts of your record the hospital has released; to let you book appointments, see and pay bills, and send messages to the hospital; to send appointment reminders; and to keep a record of who looked at your information, for your safety. We do not use your health information for advertising.
Why we are allowed to use it
Your health information is processed by or under the responsibility of your health care provider for your care (Data Protection Act 2019, sections 30 and 46), and the Digital Health Act 2023 requires providers to let you see your own records. Creating an account and connecting a record is done at your request. Reminders are part of your care and you can switch them off. Marketing messages are off unless you choose to receive them.
Who can see it
Staff at the hospital that holds your record, when they need it for your care or for running the service; TibaIQ staff only to keep the service working and secure; companies that deliver text messages and email, host the service in Kenya, or process M-Pesa payments when you pay, under contracts that protect your information; and a person you or the hospital have given proxy access to, within the limits of that access. We never sell your information. We share it with others only when the law requires it.
How long it is kept
Your account details are kept while your account is open and deleted when you close it, except records we must keep by law or for security, such as the log of who accessed your record. Your hospital record itself belongs to the hospital and is kept under the hospital's retention schedule and the law; closing your account does not delete it.
Your rights
Under the Data Protection Act 2019 (section 26) you may ask to be told how your information is used, get a copy of it, have wrong information corrected, have information deleted where the law allows, object to some uses, receive your data in a machine-readable form, and withdraw any consent you gave. You can make these requests in My Health under Settings, or at the hospital's front desk. The hospital answers a request for a copy within 7 days.
How to complain
If you are unhappy with how your information is handled, tell the hospital first so it can put things right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), in writing or in person: www.odpc.go.ke. Complaining does not affect your care.
Children and people who act for others
You must be 18 or older to create an account and connect your own record. A child's record (under 18) cannot be connected to an account as the child's own; a parent or guardian is given access by hospital staff after they check the parent's or guardian's authority. From age 12 a child's clinical information is kept confidential from the parent unless the child agrees, and a parent's access ends on the child's 18th birthday. A carer for an adult gets access only with that adult's recorded consent.
Already registered? Sign in